Quantum Readiness: Assessment & Maturity Model

What quantum readiness means

A cryptographically relevant quantum computer (CRQC) would break RSA, Diffie-Hellman and elliptic-curve cryptography. Those algorithms protect TLS, VPNs, digital signatures, PKI, payments and identity. Quantum readiness is not about owning quantum technology. It is about removing that dependency on time.

A quantum-ready organisation can answer four questions with evidence:

Where do we use quantum-vulnerable cryptography, including inside our vendors?
Which of those uses put sensitive, long-lived data or critical operations at risk?
What is our plan, timeline and budget to migrate them to post-quantum cryptography?
How far along are we, and how do we know?

Quantum readiness vs. quantum computing readiness

The phrase is used in two different ways, and it helps to be clear which one you mean:

Quantum security readiness, the subject of this guide, is being protected when quantum computers can break public-key cryptography. It is owned by the CISO, driven by regulatory deadlines and relevant to every organisation that uses encryption.
Quantum computing readiness is being ready to use quantum computers for optimisation, simulation or machine learning. It is owned by the CTO or an innovation team and driven by business opportunity.

The two are often confused in board discussions. An organisation can safely ignore quantum computing as a business tool for years, but it cannot ignore the threat quantum computers pose to the cryptography it already depends on.

Why it is urgent: Mosca's theorem

Professor Michele Mosca's rule of thumb frames the timing: if X (how many years your data must stay confidential) plus Y (how many years your migration will take) is greater than Z (years until a CRQC exists), your data is already at risk.

Take a bank with customer records that must stay confidential for 10 years and a realistic 5-year migration. That bank needs 15 years of safety, which is longer than many expert estimates for Z. Adversaries harvesting encrypted traffic today (harvest now, decrypt later) make X the real exposure window. That is why regulators ask for readiness now, not when a quantum computer is announced. For a survey of expert estimates of Z, see the Global Risk Institute Quantum Threat Timeline Report.

How to run a quantum readiness assessment

A quantum readiness assessment gives you a baseline score, a ranked list of your riskiest cryptographic dependencies and the first version of a migration roadmap. It typically runs in five steps:

Scope. Pick the business services, environments and vendors in scope. Start with the services that hold long-lived sensitive data or face the internet.
Discover. Inventory the cryptography those services use: certificates, keys, TLS and SSH configurations, libraries, KMS and HSM usage, and the cryptography your SaaS vendors use on your behalf.
Classify. Map each asset to the data it protects and how long that data must stay confidential or trusted.
Score. Rate each asset by quantum vulnerability, exposure and business impact, and place the organisation on the maturity model below.
Recommend. Produce a short list of quick wins, a sequenced migration roadmap and the governance changes needed to sustain it.

You can get an initial score in a few minutes with the free online quantum readiness assessment, then deepen it with automated discovery.

The quantum readiness maturity model

Use a five-level model to baseline your current state and track improvement quarter by quarter:

Level	What it looks like
Level 1 — Unaware	No inventory, no owner. Quantum risk is not on the risk register.
Level 2 — Aware	Leadership understands the risk. Discovery has started but is partial and manual.
Level 3 — Inventoried	A complete cryptographic inventory exists, including vendors, and risk is scored.
Level 4 — Migrating	A funded roadmap is in execution. Hybrid PQC is deployed on priority systems and vendor requirements are in contracts.
Level 5 — Crypto-agile	Cryptographic posture is monitored continuously, algorithms can be swapped through configuration, and evidence is audit-ready.

Most organisations today sit at Level 1 or 2. Regulated organisations should target Level 3 now and Level 4 on priority systems before 2030.

Quantum readiness checklist

Visibility

Cryptographic inventory covers cloud, on-prem, applications, certificates, keys and HSMs
SaaS and software vendors are included, not only internal systems
The inventory updates continuously rather than once a year

Risk

Assets are mapped to data classification and required confidentiality lifetime
Internet-facing and third-party exposure is flagged
Findings are scored and ranked by business impact

Agility

Hybrid ML-KEM key exchange is tested or enabled on priority TLS endpoints
Algorithms are configurable rather than hard-coded
PKI, CA and HSM vendors have published post-quantum roadmaps

Governance

A named owner and a board-level reporting line exist
A post-quantum cryptography policy and target algorithms (FIPS 203/204/205) are defined
Procurement contracts require vendors to disclose their PQC plans
Audit-ready evidence of posture and progress is available on demand

Quantum readiness frameworks and standards

Several public frameworks help structure a readiness programme. They answer different questions, so most organisations use more than one:

QRAMM (Quantum Readiness Assurance Maturity Model) is an open framework for assessing an organisation's own readiness, with a detailed, evidence-based question set and five maturity levels.
PQC Maturity Model (PQCMM) from the PKI Consortium rates the post-quantum readiness of products and services, which makes it useful for vendor due diligence and procurement.
NIST NCCoE Migration to PQC publishes practical guidance on cryptographic discovery and migration (SP 1800-38) developed with industry.
National timelines such as the UK NCSC's and the EU coordinated roadmap set the dates your readiness will be judged against.

The five-level model above is deliberately simple so it can be reported to a board. Use it as the summary, and a detailed framework such as QRAMM for the evidence underneath each level.

A 90-day plan to become quantum-ready

Days 1–30: Baseline. Assign ownership, run a quantum readiness assessment and start automated discovery. Begin with your SaaS vendors and internet-facing assets.
Days 31–60: Prioritise. Complete the inventory for critical business services, score risk by data lifetime and exposure, and identify quick wins such as enabling hybrid key exchange where your providers already support it.
Days 61–90: Commit. Publish a PQC migration roadmap with owners and dates, add PQC clauses to vendor contracts, and set up ongoing posture reporting for leadership and auditors.

Proving quantum readiness to auditors and customers

Quantum readiness is fast becoming a sales and audit requirement. Enterprise security questionnaires, PCI DSS v4.0 (requirement 12.3.3 on cryptographic inventories), DORA's cryptographic controls and national PQC roadmaps all ask the same thing: show us your inventory, your prioritised plan and your progress.

PQCLayer is built to produce that evidence. It inventories cryptographic assets across cloud, enterprise systems and software vendors, prioritises risk by business impact, and tracks remediation over time. This is the continuous discipline of crypto posture management. To see where you stand today, run a free scan.

Frequently asked questions

What is quantum readiness?

Quantum readiness is an organisation's ability to keep its data, identities and transactions secure once cryptographically relevant quantum computers exist. In practice it means knowing where quantum-vulnerable cryptography is used, having a prioritised plan and budget to migrate to post-quantum cryptography, and being able to prove progress to auditors, regulators and customers.

How do you measure quantum readiness?

Measure it across four dimensions: visibility (how complete and current your cryptographic inventory is), risk (whether exposure is scored by data lifetime and business impact), agility (how quickly algorithms can be changed), and governance (ownership, policy, vendor requirements and audit evidence). A maturity model with levels from ad hoc to optimised makes the score comparable over time.

What is a quantum readiness assessment?

A quantum readiness assessment is a structured review that produces a baseline score, identifies the highest-risk cryptographic dependencies, and outputs a prioritised roadmap and timeline for post-quantum migration. PQCLayer offers a free online readiness assessment that returns an initial score, recommendations and a rough readiness timeline.

When do organisations need to be quantum-ready?

Most roadmaps target 2030 to 2035. NIST IR 8547 proposes deprecating quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035, and the UK NCSC expects high-priority migrations by 2031. Because of harvest-now-decrypt-later attacks, data that must remain confidential beyond that window is already at risk.

What is Mosca's theorem?

Mosca's theorem is a rule of thumb for quantum risk: if X (how long your data must stay secure) plus Y (how long migration will take) is greater than Z (the time until a cryptographically relevant quantum computer exists), you are already late. It is a simple way to explain quantum readiness urgency to executives.

Is quantum readiness the same as quantum computing readiness?

No. In security, quantum readiness means being protected when quantum computers can break today's public-key cryptography. Quantum computing readiness, a term used by strategy consultancies, means being ready to use quantum computers for business problems. Every organisation that relies on encryption needs the first, whether or not it ever adopts the second.

Who needs to be quantum-ready?

Any organisation that holds data which must stay confidential for years, signs software or documents that must stay trusted, or sells to regulated customers. That includes banks, insurers, healthcare, telecoms, critical infrastructure, government suppliers and the SaaS and technology vendors that serve them, because their customers will ask for evidence of quantum readiness in security reviews.

Quantum Readiness: Assess, Plan and Prove It